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FOREWORD 


This document summarizes the Current Technology ACT Control System Definition and 
the Advanced Technology ACT Control System Definition Tasks of the Integrated 
Application of Active Controls (IAAC) Technology to an Advanced Subsonic Transport 
Project, one element of the NASA ACEE/EET Project. The report covers work performed 
from 3uly 1978 through October 1980 under Contracts NAS1-14742 and NAS1-15325. 

The NASA Technical Monitors for these contract tasks were R. V. Hood and 
D. B. Middleton of the Energy Efficient Transport Project Office at Langley Research 
Center. 

The work was accomplished within or under the direction of the Preliminary Design and 
the Engineering Technology Departments of the Vice President-Engineering organization 
of the Boeing Commercial Airplane Company. Key contractor personnel who contributed 
were: 


G. W. Hanks 

Program Manager 

H. A. Shomber 

IAAC Project Manager 

H. A. Dethman 

Design Integration 

L. B. Gratzer 

Technology Integration 

A. Maeshiro 

Task Manager (Current Technology ACT 
Control System Definition) 

D. Gangsaas 

Task Manager (Advanced Technology ACT 
Control System Definition) 

3. D. Blight 

Flight Controls Technology 

S. M. Buchan 

Flight Controls Technology 

C. B. Crumb 

Flight Control Design 

R. 3. Dorwart 

Product Assurance 

C. C. Flora 

Flight Controls Technology 

U. Ly 

Flight Controls Technology 

K.A.B. Macdonald 

Product Assurance 

D. C. Norman 

Flight Controls Technology 

E. T. Reiquam 

Systems Technology 

3. Shen 

Flight Controls Technology 

R. D. Smith 

Flight Control Design 

T. D. Verrill 

Flight Control Design 

T. B. Cunningham 

Honeywell Systems and Research Center 

3. C. Larson 

Honeywell Avionics Division 

E. R. Rang 

Honeywell Systems and Research Center 

R. K. Mason 

Hydraulic Research Textron 

O. A. Walkes 

Hydraulic Research Textron 


During this study, principal measurements and calculations were made in U.S. customary 
units and were converted to Standard International units for the final report of this work. 

Use of trade names or names of manufacturers in this report does not constitute an 
official endorsement of such products or manufacturers, either expressed or implied, by 
the National Aeronautics and Space Administration. 
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SUMMARY 


This report summarizes the Current and Advanced Active Controls Technology (ACT) 
Control System Definition Study Task of the Integrated Application of Active Controls 
(IAAC) Technology to an Advanced Subsonic Transport Project. Prior assessment of fuel 
savings for ACT, in combination with increased wing aspect ratio, has shown as much as a 
10% reduction in block fuel based on a current technology ACT system implementation. 
The IAAC control systems work covered by this report was designed to increase 
confidence in the means of implementing ACT functions. The work was accomplished 
under two tasks: Current Technology ACT Control System Definition and Advanced 

Technology ACT Control System Definition. 

The Current Technology ACT Control System Definition Task objectives were to (1) 
define a highly reliable, low-technical-risk ACT control system for the IAAC airplane 
configurations using current technology; (2) support assessment of the benefit associated 
with the ACT airplane by evaluating reliability, cost, and weight of the current 
technology system; and (3) identify technical risk areas and recommend system 
development and testing. 

This system architecture work addressed implementation of all potentially beneficial ACT 
functions, not just those employed on a particular airplane configuration. The approach 
was to define and evaluate two extreme system architecture forms, then define a 
"Selected System" that used the best features of the extreme forms. The Selected System 
employs three redundant digital computers to implement all of the ACT functions, four 
redundant smaller computers to implement the crucial pitch-augmented stability function, 
and a separate maintenance and display computer. The system reliability objective of 
probability of crucial function failure of less than 1 x 1 0“9 during a 1-hr flight can be met 
with current technology system components, if the software is assumed fault free and 
coverage approaching 1.0 can be provided. There is no generally accepted method to 
prove the software to be error free. However, a disciplined approach has been shown to 
be both essential and effective in producing highly reliable real-time control software. 

The Advanced Technology ACT Control System Definition Task objectives were to (1) syn- 
thesize the ACT control laws directly, using optimal control theory; (2) evaluate the 
effects of actuation system nonlinearities on gust-load alleviation and flutter-mode 
control; and (3) determine a 1990 advanced technology ACT control system architecture. 

The optimal approach to ACT control law synthesis yielded comparable control law 
performance much more systematically and directly than the classical s-domain approach. 
Certain high-frequency gust-load alleviation functions may require increased surface rate 
capability. Finally, the use of bus architecture with advanced computers (both potentially 
available circa 1990) appears to offer significant savings in airplane weight and cost. 

The results of the Current and Advanced Technology ACT Control System Definition 
Tasks, summarized in this report, show that it is feasible to implement ACT with a cost- 
effective system. However, several major concerns— system complexity, system fault 
tolerance, redundancy management, and ACT function performance in the presence of 
system failures— remain unresolved. These concerns need to be examined through design 
and test work that provides an opportunity to experiment with and demonstrate specific 
system software and hardware. The IAAC Project should undertake these objectives and 
proceed into the Test and Evaluation element of the project plan. 



INTRODUCTION 


Although active controls have been used in several past commercial transports, those 
applications were either very limited in scope or were added after the airplane was in 
production to overcome an unanticipated difficulty or to add capability to the airplane. 
Considerable evidence suggests that the greatest benefit of ACT will result from 
incorporating ACT early in the design process. However, the expected benefit lacks 
credibility because there have been no major applications of ACT. 

The first objective of the IAAC Project was to assess the benefits of a commercial ACT 
transport. During this benefit assessment, certain technical risk areas became clear. 
This led to the second objective of the IAAC Project, which was to identify technical risk 
areas and to recommend appropriate test and development programs. The final objective, 
to pursue resolution of these risk areas to the maximum possible extent within project 
resource limitations, is the focus of the current IAAC Project work. 

IAAC PROJECT 

The IAAC Project, part of the NASA/Boeing Energy Efficient Transport (EET) Program, 
has been organized into three major elements, as discussed in Reference 1 and shown in 
Figure 1. The first, Configuration/ACT System Design and Evaluation (fig. 1(a)), 
addressed the design of an ACT transport in sufficient detail to clearly identify the 
performance and economic benefits associated with the use of ACT. These airplanes 
incorporated all beneficial ACT systems, with current technology implementation 
assumed. This low-technical-risk approach (systems viewpoint) upheld the credibility of 
the overall ACT evaluation. Details of the airplane design and performance assessment 
are contained in the Initial ACT Configuration Design Study and Wing Planform Study 
reports (refs 2, 3, 4, and 5). The Current Technology ACT Control System Definition Task 
(cross-hatched part of fig. 1(a)) is summarized in this report. 

The second element, Advanced Technology ACT Control System Definition (fig. 1(b)), has 
identified potential improvements through use of optimal control law synthesis techniques 
(Advanced System Trade Studies) and advanced technology components for the 
implementation of ACT systems (Implementation Alternatives) and will address 
ACT/Control/Guidance System and Demonstration ACT System Definition. The Advanced 
System Trade Studies and Implementation Alternatives are summarized in this report. 

The final major element, Test and Evaluation, will begin work to reduce selected real or 
perceived technical risks associated with implementation of ACT. 

ACT CONTROL SYSTEM STUDY 

A modern Conventional Baseline Configuration, without any significant application of 
ACT, was required to determine the benefits of ACT and to establish the design mission 
for the ACT configurations. Except for ACT, the technology of the ACT airplanes de- 
signed under this project was fixed at the level established by the Baseline Configuration. 

The airplane configuration design work proceeded under the assumption that any 
beneficial ACT function could be implemented with appropriate reliability and avail- 
ability. The Current Technology ACT Control System Definition Task and the Advanced 
Technology ACT Control System Definition Task explored the means of implementing 
these functions. Details of the work are contained in the study final report (ref 6). 
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ACT CONTROL SYSTEM REQUIREMENTS 


ACT FUNCTIONS AND RELIABILITY 

Because the controls work was proceeding in parallel with the active control airplane 
development reported in References 2, 3, k, and 5, it was not possible to develop the 
control system for a single specific airplane. To ensure that the control system resulting 
from this work would support any beneficial active control function, as determined from 
the airplane work, the ACT functions to be implemented were selected as an all-inclusive 
set. The IAAC ACT airplane development studies have identified significant performance 
benefits of reduced pitch stability, and the ACT airplanes were configured with no 
requirement for unaugmented airframe stability. This in turn led to a requirement for a 
crucial pitch-augmented stability (PAS) system. None of the other ACT functions 
required, or could show benefit from, this degree of criticality. Table 1 lists the 
functions that were selected for this task and also shows the reliability requirement for 
each function expressed in terms of probability of failure during a 1-hr flight. 

Early in the design of a commercial transport, the design requirements and objectives 
(DRO) that the airplane must meet are established. These requirements and objectives 
include the specific mission that the airplane must perform, the methods of design and 
analysis that will be used to design and build the airplane, and the characteristics that will 
be required of the systems in normal and failed modes for the airplane. These criteria are 
typically assembled into a document that is entitled "Design Requirements and Objectives 
(DRO)." Incorporating active controls into the design of a commercial transport 
necessitated some revisions of and new parts in the DRO. Incorporating ACT impacts the 
requirements relating to flight control system design, flying qualities, and— to a lesser 
extent— structural design, hydraulic, and electric power systems. These elements of the 
DRO that needed to be changed are reported in Appendix A of Reference 2. The control 
systems work summarized in this document was intended to produce systems that 
complied with this active controls DRO. 

Determination of the criticality of any particular ACT function is made in terms of the 
impact on the airplane's operability following the loss of that function. Therefore, the 
criticality (crucial or critical) is interpreted in terms of a reliability requirement for the 
design of the system. Federal Aviation Regulation (FAR) Part 25 (ref 7) requires that the 
occurrence of any failure condition, which would prevent the continued safe flight and 
landing of the airplane, be "extremely improbable." A draft Federal Aviation 
Administration (FAA) Advisory Circular (ref 8) indicates that extremely improbable 
should be interpreted as a probability of failure less than 1 x 10" 9 during a 1-hr flight. 
Figure 2 is reproduced from Reference 8. This figure was instrumental in the selection of 
the reliability requirement probability of failure being less than 1 x 10“^ during a 1-hr 
flight for the short-period PAS ACT function. 
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Table 1. Assumed ACT Function Criticality and Reliability Requirements 


Reliability 
requirement. 
Criticality probability of 

failure during 
a 1 -hr flight 


Pitch-augmented stability, 
short-period (PASg^Qpy) 

Crucial 

10' 9 

Pitch-augmented stability, speed 

* pas speed* 

Critical 

10' 5 

Angle-of-attack limiter 
(AAL) 

Critical 

10- 5 

Lateral/directional-augmented 
stability (LAS) 

Critical 

10- 5 

Gust-load alleviation (GLA) 

Critical 

10- 5 

Maneuver-load control (MLC) 

Critical 

10- 5 

Flutter-mode control (FMC) 

Critical 

Ip ' 5 


Extremely 

improbable 


Operational limitations | 

Emergency procedures 


Catastrophic 
1 total loss 


i | Possible 

, passenger 

procedures | injur i es _ 

Immediate landing Extensive damage 


Loss of life, 
numerous injuries 


Consequence of failure condition 


Figure 2. Relationship Between the Consequence of Failure and the 
Probability of Occurrence 
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ACT CONTROL SURFACES AND SYSTEM SENSORS 


A principal measure of success with respect to design of the ACT system is the resulting 
system reliability. To calculate that reliability, specific system components and 
aerodynamic surfaces must be selected. As previously described, this control system 
implementation task was not tied to a specific airplane but rather to an airplane that uses 
a number of possible ACT functions. In support of that approach, aerodynamic surfaces 
were assigned to each of the functions assumed, as shown in Figure 3(a). With the 
exception of the flaperons, all of the surfaces are hydraulically actuated aerodynamic 
plain flaps. The rudders and elevators are dual-hinged surfaces to provide more control 
power in a given surface area. The only unusual surfaces are the flaperons, mid-span and 
inboard, which use a plain flap (aiieronlike) segment at the trailing edge of the high-lift 
system flaps. These surfaces are faired (i.e., fixed) whenever the high-lift system is 
deflected. Their purpose as active control surfaces is to deflect in high-speed flight with 
the flaps at zero deflection. As shown in the figure, stick-pusher actuation occurs at the 
column, which in turn commands the appropriate elevator deflection to limit the angle of 
attack. 

To complete the system design, specific sensors were selected and placed in the airplane 
as shown in Figure 3(b). Again, because reliability is such an important characteristic, the 
sensors are conventional and as simple as possible. Note the considerable dependence on 
accelerometers, with limited dependence on angular rate sensors. 
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(a) Assumed Active Control Surfaces 



(b) ACT Sensor Placement 


Figure 3. A CT Control Surfaces and Sensors 
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CURRENT TECHNOLOGY ACT CONTROL SYSTEM DEFINITION 


TASK OVERVIEW 

An important element of the IAAC Project was the determination that the necessary 
active control functions could be implemented in a low-technical-risk system, which is an 
important adjunct of the overall ACT objectives. This led to selection of a ground rule 
for the current technology system work that only system elements or components that are 
available at this time would be considered for implementation of the active control 
system. It was recognized that this might lead to systems of somewhat higher weight or 
potentially higher cost of ownership. However, it was judged that the system weight and 
the system cost of ownership would not offset an apparent benefit from fuel savings and 
associated performance improvements. Therefore, this work proceeded under the ground 
rule that only those components and system elements that are proven today would be 
considered for implementation of the ACT functions. 

The initial task of the Current Technology ACT Control System Definition work, as shown 
in Figure 1(a), was to postulate a preliminary ACT control system. During this subtask, it 
was determined that a predominantly digital system would best provide the many-faceted 
functions and associated redundancy management. A key element of this decision was the 
recognition that system self-test can be much more readily implemented in a digital 
architecture than in an analog architecture. Therefore, this work has proceeded under the 
assumption that the primary means of computation will be digital. 

The approach to the design of a current technology system with the appropriate reliability 
requires at the outset a determination of how system reliability and cost of ownership 
varied with system form or architecture. This was accomplished (fig. 4) by designing 
systems with two rather extreme system forms; i.e., an Integrated System and a 
Segregated System. The distinguishing characteristic of these extreme forms is 
organization of the digital computers. An Integrated System, in the context of this study, 
means that all ACT functions are accomplished in a single set of digital computers, which 
does not mean to imply that all of the computers are doing identical tasks. Rather, 
because the required redundancy varies from ACT function to function, the total 
computer redundancy level was dictated by the most demanding function; i.e., short- 
period PAS function. The less demanding functions were distributed among the computers 
in the most efficient form possible. The counterpoint to an integrated architecture is the 
segregated architecture. Segregated, as used in this work, needs to be distinguished from 
distributed. A distributed system would mean that physically the elements of the system 
are distributed throughout the airplane. Segregated means that each function is assigned 
to a specific set of digital computers. Note that these digital computers typically would 
be smaller than those used in the Integrated System, but many more would be required. 

The design and analysis of these alternative forms led to the Selected System, the 
principal output of this task, which combines some of the best features from both the 
Integrated and Segregated Systems. Several special studies supported the specific system 
design and evaluation as shown in Figure 4. The Selected System is a way to meet the 
system reliability objective, assuming the software is fault free and coverage approaching 
1.0 can be provided. 
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SPECIAL STUDIES 



Figure 4. Current Technology System Task Overview 
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ACT SYSTEM ARCHITECTURE DEVELOPMENT 


Integrated System Configuration 

The keystone of the Integrated System is the set of four ACT computers that performs all 
ACT functions, system self-tests, and redundancy management. Figure 5 shows a top- 
level view of those computers and their relation to other system elements. Consistent 
with the low-technical-risk theme of this work is the manner in which the ACT system 
meshes with the balance of the airplane control system. The Baseline Airplane has a 
triplex digital air data computer (DADC) and a triplex inertial reference system (IRS). 
These systems became major sensors for the ACT system but were not sufficient to 
provide all of the information necessary for the many ACT functions. For example, the 
crucial short-period PAS function requires four pitch-rate signals. After examining the 
alternatives, an independent, single pitch-rate sensor was added to the system to provide 
a total of four pitch-rate signals, with the remaining three coming from the IRS. The 
other ACT sensors are accelerometers and column sensors necessary to accomplish the 
various functions. 

Control of the airplane occurs through the aerodynamic surfaces illustrated in Figure 3(a); 
these surfaces are in turn signaled as shown in the right half of Figure 5 . Note that the 
mechanical control system was retained by using secondary servos to add the ACT 
commands into the mechanical control path. This is not meant to imply that this is either 
the most reliable or most desirable system form, but it was felt at the time to be the 
least controversial means of altering the control system. 

The new active control surfaces (inboard flaperons, outboard flaperons, and the inboard 
segment of the outboard aileron) are electrically commanded, hydraulically actuated 
surfaces. Because it was necessary to add new actuators to power the surfaces, 
electrically commanded actuators were selected. 

Pilot and autopilot inputs are provided to the primary actuators exactly as in the Baseline 
Airplane. 
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Sensors 


Computers 


ACT secondary 
actuators 


Primary Pilot Autopilot 



Outboard ailerons, inboard segment 
] Active control system.equipment 


Figure 5. Integrated System Configuration 
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Segregated System Configuration 


The principal difference between the Integrated and Segregated Systems (fig. 6) is the 
substitution of 21 separate computers for the 4 ACT Primary Computers and 1 
maintenance computer of the Integrated System. These 21 computers, arranged as shown 
in the figure, accomplish each separate ACT function and redundancy management of the 
total system. 

The only change to the sensors is the addition of three additional pitch-rate sensors, for a 
total of four, dedicated to the short-period PAS augmentation task. This change was 
made by removing the inertial reference system from that control path to increase the 
crucial function reliability. The output side of the system has the same number of 
secondary actuators summed similarly into the mechanical system and the same number 
of electrically signaled primary actuators as the Integrated System. 
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ACT secondary 

Sensors Computers actuators Primary Pilot Autopilot 



Active control system equipment 


Figure 6. Segregated System Configuration 
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System Comparison 


An expectation of the Segregated System configuration was improved reliability. It was 
expected that the Segregated System cost would be greater than the Integrated System 
cost. However, a key factor was whether the cost increased faster than the reliability 
increased; in other words, what happened to the return on investment (ROI). The first two 
columns in Table 2 compare the Integrated System and Segregated System principal 
characteristics and probability of failure during a 1-hr flight with the impact on airplane 
operation. This impact appears as either continuing the flight with restricted flight 
envelope, a necessity to divert, or a dispatch delay. The impact of any particular failure, 
of course, depends on the ACT function that is degraded or lost and its impact on the 
airplane. 

The two systems used the same assumed computer reliability. The probability of 
restricted flight did not improve as expected. The probability of flight diversion and 
dispatch delay did improve with the Segregated System compared to the Integrated 
System. The Segregated System was almost 50% more expensive than the Integrated 
System, which resulted in a decrease in the expected return on incremental investment. 
Careful consideration of the reasons for this decline in reliability, as reflected in the 
probability of restricted flight, highlighted the sensor set as the primary cause of the 
decline. The heavy dependence of the ACT functions on the output of the DADC, 
combined with the increased parts count in the greater number of computers, led to a 
decline in reliability. An examination of the attributes of these two systems led to the 
definition of the Selected System, shown in column three in Table 2, which combines some 
of the best features of the previous two systems. The Selected System has better overall 
reliability than the Integrated System, at about the same cost, and almost the same return 
on incremental investment. The expected airplane performance benefit that is reflected 
in the return on incremental investment calculations is based on the Initial ACT 
Configuration (ref 2), adjusted for differences in the ACT systems. 
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Table 2. Comparison of Integrated, Segregated, and Selected Systems 


System 

Item 

Integrated System 

Segregated System 

Selected System 

Computer 

weight 

4 control computers 
at 11.3 kg (25 1b) 
each 

Total: 45.4 kg (1001b) 

19 control computers 
at 6 kg (13.25 lb) each 

2 management computers 
at 2.7 kg (6.0 lb) each 
Total: 119.6 kg (263.8 1b) 

3 ACT Primary Computers at 1 
(25 lb) each 

4 Essential PAS Computers at ( 
(13.25 lb) each 

1 ACT Maintenance and Displa 
Computer at 2.7 kg (6 lb) 
Total: 60 kg (134 lb) 

Memory 

requirement 

32K read-only memory 
(ROM) and 

2K random-access memory 
(RAM) (128-word 8-bit non- 
volatile memory for mainte- 
nance information) 

16K ROM and 64- to 512-word 
RAM for control computers plus 
32 K ROM and IK RAM and 128- 
word 8-bit nonvolatile for 
management computer 

24K ROM and 2K RAM per ACT Priman 
1 1K ROM and 256-word RAM per Essen 
32K ROM and IK RAM and 128-word, 8 

Computer 

reliability 

(assumed) 

6800-hr mean time between 
failures (MTBF) 

6800-hr MTBF 

6 800-hr MTBF for ACT Primar 
12 000-hr MTBF for Essential PA 

Probability of 
restricted flight 

2.5 x 10~ 3 per 1 -hr flight 

3.3 x 10' 3 per 1-hr flight 

1.7 x 10 ^ per 1-hr fligh 

Probability of 
flight diversion 

7.1 x 10"^ per 1 -hr flight 

2.6 x 10~ 4 per 1-hr flight 

4.0 x 10" 4 per 1-hr fligh 

Probability of 
dispatch delay 

3.8 x ICf^per dispatch 

1.6 x 10‘3per dispatch 

1.2 x 10 -4 

Increment cost 
per airplane 
(to airline) 

$274 000 

$390 000 

$297 100 

Expected return 
on investment 

25.1% 

22.8% 

24.6% 


































Selected System Configuration 

The form of the Selected System (fig. 7) results from the decision to accomplish the 
critical ACT functions and Full PAS function in a triplex set of primary computers. The 
Full PAS function provides good (level 1) handling qualities, but the triplex set cannot 
provide sufficient reliability to accomplish the crucial short-period PAS function; 
therefore, it is backed up by a quadruple set of essential computers. All communication 
to the elevator servos occurs through the Essential PAS Computers; i.e., the normal 
handling qualities pitch augmentation and the wing-load alleviation elevator commands 
are passed to the Essential PAS Computers and then on to the elevator secondary servos. 

If a failure, or failures, are detected in the ACT Primary Computers that result in loss of 
the short-period PAS function, the ACT Primary Computers are taken out of that loop and 
the Essential PAS Computers provide a minimum (level 3) handling qualities pitch 
augmentation using the four dedicated pitch-rate sensors and the four Essential PAS 
Computers. These minimum handling qualities are judged sufficient to safely land the 
airplane but may not be sufficient to continue the mission as originally planned. 
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Figure 7. Selected System Configuration 
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AIRPLANE SYSTEMS 


Hydraulic Power System 

The hydraulic power system consists of three 20 700-kPa (3000-lbf/in 2 ) systems identified 
as A, B, and C, as shown in Figure 8. Hydraulic power is generated in systems A and C by 
engine-driven pumps (EDP) installed in parallel with electric-motor-driven pumps (EMP). 
Hydraulic power is generated in system B from two ac-powered electric-motor-driven 
pumps and one air-turbine-driven pump (ATDP). The bleed air manifold is a pneumatic 
source supplied by the engines or the auxiliary power unit (APU). 

Emergency hydraulic power is derived from wind-milling engines driving the engine-driven 
pumps. System A is augmented by a ram-air-turbine-driven (RAT) hydraulic pump. 

With the airplane on the ground, hydraulic power is available from the APU, automatic 
ground carts driving the air-turbine-driven pumps, or from the ac electric-motor-driven 
pumps powered from either the APU, the ground carts, or by an external hydraulic power 
supply source. Flight deck controls and displays consist of depressurization switches, 
shutoff switches, low-pressure and low-fluid quantity warning lights, and a selectable 
system pressure and fluid quantity readout. 

The maximum system flow requirements are only slightly greater than they would be for a 
nonactive control airplane and are shown in Figure 8. The several approaches to ACT 
system design, previously discussed, do not affect the hydraulic system design. 
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Electric Power System 


The electric power system shown in Figure 9 is a three-phase, 115V, 400-Hz system 
supplied by two engine-driven, 90-kVA integrated-drive generators. These generators 
cannot be paralleled, so the system operates as two isolated channels. A third 90-kVA 
APU-driven generator is provided as an in-flight backup for the two main engine-driven 
generators and for ground maintenance operations. The APU can be started at any 
altitude up to 7620m (25 000 ft) and can provide full electric power up to 10 670m 
(35 000 ft). 

Any single generator can supply all flight-essential loads. Two of the three generators 
must be operative for airplane dispatch without load reduction or for a category III 
landing. 

Airplane 28V dc power is provided by two 120A unregulated transformer-rectifier (T-R) 
units. Each of the main ac buses supplies its own transformer-rectifier unit. 

Backup power for flight-critical loads is supplied by a pair of nickel-cadmium batteries. 
Battery chargers provide controlled recharge of the battery and operate a transformer- 
rectifier unit to supply standby loads if the main dc source is lost but ac power is 
available. 

ACT considerations required the addition of the equipment outlined in bold in Figure 9 to 
a system that was suitable for a conventional commercial transport. The principal 
difference is the addition of this second standby battery and charger to provide power for 
flight-critical ACT functions. The battery life, in such operation with no other electric 
power source available, is estimated to be 30 min. 
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Primary Control System 


Longitudinal— The longitudinal control system, consisting of elevator control and 
horizontal stabilizer trim, is illustrated in Figure 10. Each single-segment, dual-hinged 
elevator is powered by three parallel power control units (PCU). The pilot elevator 
command transmitted from the control column through the control cables to the aft 
quadrant is mechanically summed with the autopilot and ACT elevator commands. 

Elevator command signals from the triplex ACT Primary Computers are connected to 
Essential PAS Computers A, B, and C. These signals are made available to all four 
Essential PAS Computers through cross-channel communication links. Three of the 
quadruple Essential PAS Computers command the triplex force-summed elevator 
secondary servos. In addition to the triple ACT elevator secondary servos, a servo 
mathematical model is programmed in the Essential PAS Computers— for comparison with 
actual servo performance— to provide the required fail-operational/fail-operationai 
capability (i.e., the elevator command output from the servos continues after two servo 
failures) for short-period PAS. 

Lateral— The lateral control system consists of inboard ailerons, outboard ailerons (inboard 
and outboard segments), and 10 spoiler panels (5 on each wing) as shown in Figure 11. 
The pilot's commands are transmitted mechanically through cables to the central control 
actuator where they are summed with the autopilot commands and transmitted on to the 
inboard aileron. The inboard aileron position commands are summed with the output of 
the ACT aileron secondary servos to form the outboard aileron (outboard segment) 
command. The inboard segment of the outboard aileron responds to electrical commands, 
which are the sum of the pilot commands and the ACT commands. The spoilers respond 
electrically to pilot and autopilot commands. The baseline outboard aileron lockout signal 
from the control system electronic units (CSEU) removes the pilot lateral control 
command from the outboard aileron (outboard segment) PCUs at the lockout airspeed 
without affecting the WLA commands to this aileron. 

The secondary servos and electrically commanded PCUs on the outboard aileron inboard 
segment are dual force-summed units. To provide adequate redundancy and fail- 
operational capability, mathematical models of these servos are programmed into the 
ACT computers and used in a manner similar to the elevator servo model. 

Directional— The directional control system consists of two double-hinged rudders (fig. 12); 
each rudder is controlled by dual power control units. The rudder command is the sum of 
pilot commands, transmitted by cable to the aft quadrant, and the autopilot and ACT 
rudder commands. The required ACT system reliability is provided through dual force- 
summed secondary servos plus mathematical models implemented in the ACT Primary 
Computers to provide fail-operational capability. 
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ACT FUNCTIONS 


Full Pitch-Augmented Stability 

The Full PAS control laws are implemented in the triplex ACT Primary Computers. Full 
PAS includes short-period and speed stability to provide good (level 1) pitch-axis handling 
qualities; i.e., equal to or better than a conventional transport airplane. Figure 13 is a 
block diagram of the Full PAS System. 

Short-period PAS uses pitch-rate signals from the triplex inertial reference system 
sensors and control column sensors to generate the elevator command. The pitch-rate and 
column sensors are hardwired to specific ACT Primary Computers. Computer cross- 
channel communication includes sensor signals so that each computer has access to all 
sensor inputs. The feedforward and feedback gains of short-period PAS are scheduled as a 
function of airspeed. If the airspeed sensor fails, the gain schedule becomes dependent 
upon flap position signals. If the inertial reference system signals are lost, pitch-axis 
control deteriorates to a minimum acceptable level (level 3). However, the pilot will be 
able to continue to control the airplane with a combination of the remaining speed PAS 
and the Essential PAS System (described in the next section). The ACT Primary 
Computers transmit status information on short-period PAS to the Essential PAS 
Computers to enable timely engagement of the Essential PAS control law. 

When elevator deflection exceeds a certain threshold value for more than a predetermined 
time, the elevator offload logic acts to adjust pitch trim by moving the horizontal 
stabilizer through the stabilizer trim interface in the CSEU. The CSEU trim function 
receives autopilot, pilot, and ACT trim inputs and selects an appropriate signal for 
stabilizer position. 
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Figure 13. Full Pitch-Augmented Stability Block Diagram 






Essential Pitch-Augmented Stability 


The Essential PAS control laws are implemented in the quadruple set of Essential PAS 
Computers. The Essential PAS System is a highly reliable, fixed-gain, short-period 
augmentation system that provides at least minimum acceptable handling qualities 
(level 3) in the pitch axis. Figure 14 is a simplified block diagram of the system. The 
system uses dedicated quadruple pitch-rate sensors, quadruple dedicated computers, and 
triple elevator secondary servos in conjunction with servo mathematical models in each of 
the quadruple computers. 

The pitch-rate sensors are simple, highly reliable analog devices dedicated to the 
Essential PAS System. Each pitch-rate sensor is directly connected (hardwired) to all of 
the Essential PAS Computers. The consolidated pitch-rate signals are processed by the 
signal selection and failure detection (SSFD) algorithm to create a signal for control law 
computation and to monitor system failure status. The output of the Essential PAS 
control law is normally disconnected from the servocommand summing circuits. If the 
short-period PAS of the ACT Primary System fails, the fixed-gain short-period PAS shown 
in Figure 14 is introduced into the loop with an easy-on logic. The Full PAS and 
maneuver-load control (MLC) elevator commands of the ACT Primary System are 
processed by the SSFD to form a summed elevator command and to monitor failure status. 
To protect functional independence, elevator commands of short-period PAS, speed PAS, 
and MLC are processed separately by the SSFD algorithm. 

Elevator command signals from the triplex ACT Primary Computers are connected to 
Essential PAS Computers A, B, and C and made available to all four Essential PAS 
Computers through cross-channel communication links. The Essential PAS Computers 
operate asynchronously. This feature has been shown to be satisfactory in laboratory 
tests. Three of the quadruple Essential PAS Computers command the triplex force- 
summed elevator secondary servos, as shown in Figure 14. The fourth Essential PAS 
Computer provides a servocommand and servo status for use in selecting the 
servocommand and/or shutting down a failed servo. 
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Angle-of-Attack Limiter 

The angle-of-attack limiter (AAL) function includes both warning (stick shaker) and 
limiting (stick pusher) functions. The AAL function is implemented in the triplex ACT 
Primary Computers. Figure 15 is a block diagram of the AAL system. 

The stick-shaker and stick-pusher actions are functions of angle of attack (relative to a 
reference angle of attack) and the rate of change of angle of attack. These AAL 
reference points are a function of airplane leading-edge slat and trailing-edge flap 
position as well as airspeed. When the difference between the actual angle of attack and 
the stick-shaker reference angle of attack falls below a certain threshold, the stick shaker 
is activated to provide stall warning. The threshold is a function of how rapidly the 
airplane is approaching stall; i.e., if there is a large rate of increase in angle of attack, 
the threshold is lowered to further ensure that limiting occurs at or below the maximum 
allowable angle of attack. 

If angle of attack continues to increase beyond that for warning, the stick pusher operates 
to apply an airplane nose-down force on the control column. The AAL stick-pusher 
actuator uses low-pressure air from the basic airplane engine bleed system and pressure 
from an accumulator as multiple power supplies to meet the fail-operational requirement. 
Actuation time of the stick-pusher actuator is approximately 0.2 sec. 

The pilot may override the pusher by exerting sufficient force on the column or by 
operating a manual dump valve that directly vents actuator operating pressure. 
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Figure 15. Angle-of-Attack Limiter Block Diagram 
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Lateral/Directional-Augmented Stability 

The lateral/directional-augmented stability (LAS) function includes a conventional yaw 
damper and turn coordination and is implemented in the triplex ACT Primary Computers. 
Figure 16 is a block diagram of the LAS function. 

Yaw rate and bank angle from triplex IRS and control wheel sensors are used to improve 
Dutch roll damping and reduce side-slip angle excursions. Air data signals from the 
triplex digital air data computers are used as gain schedule inputs to provide good (level 1) 
handling qualities. If the digital air data computer fails, LAS uses flap position as a 
backup gain schedule input. 

The airplane can be dispatched, with restriction, with a single-channel LAS system 
operational because (1) LAS has adequate self-monitoring, (2) the pilot can detect system 
failure by observing airplane performance and motion, and (3) system authority and rate 
limits preclude structural damage in the presence of hardover or oscillatory failures. 

Two of the triplex ACT Primary Computers command the rudder control surfaces through 
parallel force-summed secondary servos, similar to the elevator. Mathematical servo 
models are implemented in the triplex computers to provide fail-operational capability. 
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Wing-Load Alleviation 


The wing-load alleviation (WLA) function, which includes maneuver-load control (MLC) 
and gust-load alleviation (GLA), is implemented in the triplex ACT Primary Computers. 
Figure 17 is a block diagram of WLA, showing sensors and control surfaces. The WLA 
function commands deflections of the inboard and outboard flaperons, the outboard 
aileron (both segments), and the elevator. Airplane center-of-gravity and wing normal 
acceleration signals, gain scheduled from air data signals out of the triplex digital air data 
computers, are used to command appropriate control surface deflections to achieve the 
desired maneuver-load distribution and gust-load reduction. 

MLC controls wing-load distribution resulting from pilot-commanded maneuvers and 
reduces low-frequency gust loads. The principal MLC signal is center-of-gravity normal 
acceleration. To compensate for the pitching moment resulting from symmetric aileron 
deflection, an elevator command is sent to the Essential PAS Computers, where it is 
summed with other elevator commands. 

The principal GLA signal is wing normal acceleration. GLA controls the high-frequency 
gust loads through appropriate commands to the outboard aileron (inboard and outboard 
segments). 

WLA and pilot commands to the outboard segment of the outboard aileron are 
mechanically summed, producing an input command to the outboard aileron actuators. 
WLA commands to the inboard segment of the outboard aileron are electrically summed 
(in software) with flutter-mode control and pilot commands before being transmitted to 
the dual force-summed inboard segment actuators. The flaperons are used solely as WLA 
surfaces and are electrically signaled from triplex ACT Primary Computers. 
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Flutter-Mode Control 


The flutter-mode control (FMC) function suppresses wing flutter modes for airspeeds 
between dive and 1.2 times the dive speed. Figure 18 is a block diagram of the FMC 
function. FMC uses sensed outboard wing normal acceleration to develop a command for 
the inboard segment of the outboard aileron. Triple accelerometer outputs from the right 
and left wing are processed through the signal selection and failure detection algorithm to 
generate a signal for the control law computation and sensor monitors. Air data signals 
from the digital air data computer are used in the control law to produce commands 
sensitive to various airspeeds. The output of the FMC control law is summed with pilot 
commands and wing-load alleviation control law output to form the inboard segment of 
the outboard aileron deflection commands. 
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REDUNDANCY MANAGEMENT 


Redundancy Management in the ACT Primary Computers 

Redundancy management is the process that enables continued operation of the ACT 
system in the presence of certain transient or permanent failures of the system. System 
elements are monitored for faults using a combination of hardware and software. Faults 
are primarily detected by cross-channel comparison, with inline monitoring supplementing 
cross-channel comparison to provide fault isolation. Critical systems will survive any 
single failure, except actuator jam, without affecting performance. The crucial system 
will survive two similar failures, including a jam. The crucial system can survive an 
actuator jam because both elevator servos and power control units are triplex and force 
voted. Following clearance of a transient fault, the system recovers to the redundancy 
level in effect before the failure. Following a failure that leaves only two success paths 
for a function, a subsequent disagreement in those paths will lead to shutdown of the 
function or reconfiguration to a degraded mode. Single-thread operation will be allowed 
only if it can be shown that a subsequent failure is not a threat to the safety of the 
airplane. 

These redundancy management goals are achieved by system monitoring and reconfigura- 
tion and additional failure protection through design features such as physical and 
functional isolation in redundant channels, supplying electric power from redundant 
sources, and hydromechanical voting. System monitoring and reconfiguration is 
performed under the control of the ACT Primary Computers and the Essential PAS 
Computers on three separate planes: sensors, computers, and servoactuators. Figure 19 
illustrates the redundancy management processes performed by the ACT Primary 
Computers. 

Signal selection and failure detection (SSFD) protects against failures of the sensors, 
wiring, and input sections of the computer. Each computer uses SSFD to select a single 
value from each set of redundant sensors and uses failure detection and reconfiguration to 
isolate failed sensors. SSFD is performed primarily in software for those sensors whose 
output normally has a steady-state (dc) component (e.g., airspeed and angle of attack); 
the last "good" value is held whenever two of the three sensors fail. For those sensors 
with values that are normally zero, the selected value is set to zero when the sensors fail. 

Failure detection is accomplished by comparing input signals in error detectors. These 
detectors have different thresholds and detection times for dynamic failures and for 
static errors. For signals that are not equalized, there is only a single detector, which is 
essentially a dynamic fault detector. Each detector uses a counter scheme to prevent 
nuisance trips and to provide oscillatory failure protection. Signal selection operates on 
those signals that have not exceeded thresholds. When a signal has been determined to be 
failed, sensors are reconfigured to exclude that signal from the selection process, but the 
fault detector continues to monitor all signals. The selection process selects the median 
signal when none of the signals has failed and averages the unfailed signals when only two 
good signals remain. 
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Redundancy Management in the Essential PAS Computers 


Redundancy management in the Essential PAS Computers is portrayed in Figure 20. 
Sensor selection is slightly more complex in the quadruple Essential PAS Computers than 
in the triplex ACT Primary Computers. An active, online selection process is used for the 
four dedicated pitch-rate sensors; three signals are considered active and are fed directly 
into the selector. All four signals are monitored for failure, but the standby signal is not 
used unless one of the active signals fails. 

The selection process becomes (1) median of active channels with no failures; (2) after the 
first failure, median of active channels with the standby channel replacing the failed 
channel; (3) after the second failure, average of unfailed channels; and (4) with three 
failures, a "best-value" selection. Best-value selection uses inline monitoring to select 
the remaining good signal, but because it does not provide 100% failure detection, it may 
not be possible to determine the good sensor. Loss of sensor data for the Essential PAS 
Computer can result in loss of pitch augmentation, which must be extremely improbable. 
Therefore, one of the signals is arbitrarily selected if inline monitoring does not provide 
enough information to determine which of the sensors has failed. Reliability analyses 
indicate that loss of three sensor signals in the Essential PAS System meets the extremely 
improbable criterion. 

The Essential PAS Computers also select the Full PAS signal from the ACT Primary 
Computers to command the elevator. The SSFD algorithm used in this instance is altered 
to account for simultaneous failures, as redundancy management of the ACT Primary 
Computers masks the effect of sensor failures on the output. A single sensor failure will 
not affect the output, but a second similar failure can cause all three ACT Primary 
Computers to simultaneously shut down their outputs. The Essential PAS Computer 
cannot obtain sufficient information about the PAS command from the ACT Primary 
Computers by comparison monitoring alone to properly determine the status of that 
command. Discrete status bits from the ACT Primary Computer are used to augment the 
monitor information. If a signal fails a comparison, or a vote of the status bits indicates a 
signal has failed, that signal is no longer used by the selector. If two or more signals fail, 
the PAS command from the ACT Primary Computers is disregarded and the output from 
the Essential PAS control law computation is substituted. 

For both ACT Primary and Essential PAS Computers, the sensors are continuously 
monitored. If a failed signal returns to within tolerance for a prescribed period of time 
and inline testing indicates it is good, the sensor is considered recovered and once again 
becomes active. 
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Figure 20. Redundancy Management Processes, Essential Pitch-Augmented Stability Computers 

















System Test and Maintenance 


Successful commercial operation of an active control transport will depend upon a 
comprehensive system self-test capability. This testing falls into two broad categories: 
preflight (both electronic and mechanical) and in-flight. Figure 21 is an overview of the 
test and maintenance activity and the location where that activity occurs. 

One objective of the IAAC Project was to design an active control system so structured 
that the ACT computers do the system self-test. The self-test must recognize single or 
multiple ACT function loss and its impact on airplane operability. The electronic 
preflight test (initiated by the crew) occurs at the gate, simultaneously in the ACT 
Primary Computers and the Essential PAS Computers, and requires less than 30 sec, 
compared to a normal departure preparation time of approximately 10 min. The 
electronic preflight test tests computers, sensors, and interfaces among computers, 
sensors, and actuators. If no faults are identified or if they are such that the airplane can 
continue, either with or without restriction, the airplane is cleared to depart. Otherwise, 
the airplane cannot be dispatched. 

The mechanical part of the preflight test requires ground clearance and would normally be 
accomplished while the airplane is taxiing to the takeoff position; minimum taxi-out time 
for this type of airplane is about 4 min. It is estimated that the ACT mechanical preflight 
(checking servo response) requires about 30 sec and would accompany the normal control 
pullthrough (movement of the cockpit controls to verify proper control surface movement) 
that the crew accomplishes during taxi. The airplane is cleared for flight if the test is 
successfully passed. 


System self-test during flight is a continuous monitoring activity. The ACT computers 
perform multiple control law and redundancy management calculations during flight and 
also monitor the system. The computer memory required for system test is estimated to 
be 8200 words in the ACT Primary Computers and 5500 words in the Essential PAS 
Computers. In-flight monitoring begins automatically with the no-weight-on-wheels 
condition following lift-off and verifies that computers, interfaces, sensors, and actuators 
are all functioning normally. In the absence of a fault, flight continues in a normal 
manner. The identification of a fault can result in one of three conditions. Faults that do 
not affect continued safe operation of the airplane are simply flagged for subsequent 
maintenance action and the airplane proceeds without restriction. Other faults will 
require introducing a restricted flight envelope within which the airplane can continue the 
mission. The third result from a fault identification could be diversion to the nearest 
available field (not shown on the figure). 


For faults that affect operation (e.g., dispatchability, continued normal operation, 
introduction of a restricted flight envelope, or the need to divert), the system determines 
the status of the ACT function or functions affected by the fault and displays that status 
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Figure 21. Test and Maintenance Overview 





















ACT Maintenance and Display Computer 

The ACT control laws reside in either the triplex ACT Primary Computers or the 
quadruple Essential PAS Computers. This use of two separate sets of control computers 
necessitates a separate maintenance and display computer unit to coordinate 
communication of start of test, annunciation of significant failures, selection and 
transmission of appropriate operations advisory messages, and retention of fault 
information for maintenance use. The ACT Maintenance and Display Computer meets 
these requirements. As shown in Figure 22(a), it is not necessary for dispatch. 

In its normal mode of operation, the ACT Maintenance and Display Computer accepts 
fault information from the ACT Primary Computers and the Essential PAS Computers. 
This information is processed in the ACT Maintenance and Display Computer to determine 
function status and the resulting advisory message(s), if required. This processing, 
combined with the basic caution and warning system of the airplane, presents the crew 
with essential fault information and any necessary operational changes. Thus, when the 
ACT Maintenance and Display Computer is active, the pilots do not need to refer to an 
operations manual to determine their appropriate response to an ACT system failure. 

Figure 22(b) summarizes the various crew communication provisions associated with the 
ACT system. In the primary operating mode, the caution annunciator display will report 
all system information essential to the flight crew. This information includes 
identification of failed line replaceable units (if they are required for dispatch) and any 
change in flight plan made necessary by system failures. Fail-operative communication 
from the ACT system to the flight crew is achieved through the baseline caution and 
warning system plus dedicated discrete indicators showing the status of all ACT functions. 

In the backup mode, following the loss of the ACT Maintenance and Display Computer or 
the caution annunciator panel, the dedicated discrete status indicators are the principal 
means of communication to the crew. Flight manual data are provided to interpret those 
indicators in terms of required operations changes; e.g., dispatch or not, continue without 
restriction, etc. 

In normal operation, system failures are followed by automatic reconfiguration or 
automatic function disconnect. Manual control will be provided only for initiation of 
preflight test and emergency disconnect. 


44 



ACT System 


Baseline Caution and Warning System 


Not required 
for dispatch 


Minimum 
equipment 
list items 


ACT 

Maintenance 
and Display 
Computer 


ACT 

discrete 

display 


( Function j 
status J 


ACT 

Primary 

Computers 


Essential 

PAS 

Computers 


Caution 

advisory 

computer 


Warning 

electronics 

module 


Caution 

annunciator 

display 


Caution 
and warning 
discrete 
display 


Failure 
notice and 
operations 
advisory 


(a) ACT Displays 


Switches (momentary 
contact, illuminated) 



Start prefTight, electronic 
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(b) ACT Cockpit Displays Requirement 

Figure 22. ACT Cockpit Displays 
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Software Reliability 


The probability of failure of the ACT system crucial function during a 1-hr flight must not 
exceed 1 x 10"9. There is no generally accepted method to prove software reliability 
consistent with this requirement. Moreover, it would appear that it is not possible to 
define a study that could convincingly indicate that this order of reliability is attainable. 

On the other hand, very high levels of reliability for real-time software have been 
demonstrated in command and control systems for space missions and operations. (One 
example is the system used in the Lunar Orbiter missions in 1966 and 1967.) High 
reliability in such systems results from a carefully conceived approach and plan that is 
implemented in a disciplined manner. Figure 23 shows the essential elements of this 
process, of which exhaustive testing is one of the most important. 

The software design process indicated by the elements in Figure 23 may be long and 
involved, and some parts of the process become "iteration loops" as testing discloses 
shortcomings in the design. However, extensive experience in engineering real-time 
digital control systems (spacecraft and airplanes) has shown that this process is not only 
essential but also effective in producing highly reliable real-time software. 
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Configuration control 


Documentation 


Figure 23. Elements of Systematic Software Development 
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ACT SYSTEM COST-OF-OWNERSHIP ANALYSIS 


Calculation of ACT system cost of ownership contributes to an objective judgment of the 
various approaches to ACT system implementation. Present dollar values per flight hour 
are calculated for such economic parameters as fuel savings, maintenance cost, spares 
inventory cost, and system purchase cost. The analysis results are summarized in Table 3. 

The results of the cost-of-ownership analysis are displayed as the return on incremental 
investment relative to the Conventional Baseline Configuration (ref 9). 

Except for flaperons, the ACT systems are those previously discussed and include PAS, 
LAS, WLA, FMC, and AAL. The cost-of-ownership analysis was based on airplane cost, 
weight, performance, and maintenance cost estimates for the Initial ACT Airplane (refs 2 
and 3), which implemented these desired ACT functions but did not use wing flaperons. 

The analysis is based on a 1985 service entry date and an inflation rate of 10% per year on 
all cost-of-ownership parameters except fuel. Fuel cost was assumed to inflate at 15% 
per year and was $0,555/52 ($2. 10/gal) in 1985 dollars. The principal assumptions in the 
analysis are that the airplane is being operated in a 30-aircraft fleet over an 863-km (466- 
nmi) average trip. The duration of this average trip is 1.25 flight hours. The incremental 
price of the ACT airplane is based on a 300-airplane production run, and it was assumed 
that the minimum attractive return on investment to the airline is 15%. All costs are in 
1978 dollars unless otherwise stated. The Segregated System shows the highest 
incremental aircraft price because of the 21 computers used in that system, as compared 
with 4 larger computers in the Integrated System. The Selected System is significantly 
less expensive than the Segregated System but higher than the Integrated because of four 
additional small computers (Essential PAS Computers) and three additional dedicated 
pitch-rate sensors. Implementation of the Selected System with pitch fly by wire was 
examined briefly and showed the lowest incremental cost, largely due to the reduction in 
parts count resulting from deletion of the mechanical control system. 

The incremental test equipment cost is based on the assumption that the airline would 
already possess basic digital test equipment for the rest of the digital electronic suite. 
The cost increment is thus based on additional equipment unique to the ACT system. The 
maintenance cost per flight hour is calculated based on past experience and recent 
predictions at the significant line replaceable unit level. The Integrated System displayed 
the highest incremental delay and flight cancellation cost ($0.54 per flight hour) because a 
single flight control computer or the IRS failure prevented dispatch of the airplane. 

Considering the cost and performance parameters described previously as nominal, a 
sensitivity analysis was performed to determine the effect of variations in these 
parameters. The results of this analysis are shown in Figure 24. The line labeled "fuel 
saved or fuel cost" simply reflects the fact that in this sensitivity analysis it does not 
matter whether the fuel savings increase by 50% or the fuel cost increases by 50%, the 
effect was the same on the return on incremental investment. The equipment first-cost 
effect was much as would be expected. The result was much less sensitive to 
maintenance cost than had been originally anticipated and is very encouraging. 

These return on incremental investment analyses show the ACT system and airplane to be 
a highly attractive investment at the expected fuel price inflation rates. The payback 
period for all systems is desirably short, and the return on incremental investment to the 
airline exceeded the 15% minimum attractive rate mentioned above. 
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Table 3. Cost-of -Ownership Results of Various ACT Systems 


Parameter incremented 

ACT technology base 

Integrated 

Segregated 

Selected 

Selected, 
pitch FBW 

Aircraft purchase cost per aircraft 

$274 000 

$390 200 

$297 100 

$207 000 

Maintenance manual cost per 
30-airplane fleet 

$21 000 

$31 400 

$26 100 

$26 100 

Test equipment cost per 
30-airplane fleet 

$22 500 

$44 900 

$33 600 

$33 600 

Spare inventory initial cost per 
30-airplane fleet 

$250 000 

$356 000 

$271 100 

$271 100 

Maintenance cost per aircraft 
flight hour 

$4.18 

$4.91 

$4.22 

$3.98 

Departure delay and cancellation 
cost per aircraft flight hour 

$0.54 

$0.45 

$0.19 

$0.12 

Change in system weight 
relative to Integrated System 

0 

+114 kg 
(+252 lb) 

+14 kg 
(+30 lb) 

-157 kg 
(-345 lb) 

Fuel saving per flight hour at 
863 km (466 nmi) 

160 kg 
(352 lb) 

146 kg 
(322 lb) 

160 kg 
(352 lb) 

172 kg 
(379 lb) 

Payback period in years 

2.83 

4.14 

2.98 

2.02 

Return on incremental investment to airline 

25.1% 

22.1% 

24.6% 

27.6% 


* Assumes 1985 introduction with fuel cost of $0,555/6 ($2.1 0/gal) and that fuel cost inflates 
at 15% per year against a general inflation rate of 10% per year. 



Minimum 
attractive 
return on 
investment 


Figure 24. Effect of Changes in Cost Parameters on Return on Incremental Investment 
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ADVANCED TECHNOLOGY ACT CONTROL SYSTEM DEFINITION 


ADVANCED SYSTEM TRADE STUDIES 

The overall objective of the Advanced Technology ACT Control System Definition Task 
was to define advanced ACT control systems for future commercial transports. The work 
consisted of two tasks: Advanced System Trade Studies and Implementation Alternatives. 
The classical approach of synthesizing one control loop at a time is not well suited to deal 
directly and efficiently with coupled multiloop systems or to take advantage of favorable 
interactions between the control loops. The objectives of the Advanced System Trade 
Studies were to develop control law analysis and synthesis methods suitable for a coupled 
multiloop system and to demonstrate the potential benefits of these methods by 
evaluating closed-loop performance of the resulting control laws. The methods used were 
based on modern optimal control and estimation theory. Control laws were synthesized 
for GLA, FMC, and rigid body (quasi-static aeroelastic) PAS and command-augmentation 
control laws. 

GLA and FMC control law performance was evaluated based on indicated wing load 
(approximate expressions of the load contained in the mathematical model) and control 
surface activity, both in response to continuous random vertical turbulence and in 
response to discrete vertical gust. PAS control laws were evaluated based on pitch rate 
and load factor response to elevator commands. 

Because of the complexity of the ACT control task and the dynamic characteristics of a 
typical flexible transport airplane, the ACT control law synthesis necessitates solving a 
coupled multiloop control problem. The design was accomplished using a set of 
experimental computer programs, based on time-domain modern control theory, suitable 
for the analysis and synthesis of multivariable controllers. Key elements are a state- 
space representation of the dynamic system, modal analysis, and optimal control and 
observer synthesis. The design process begins with model generation, then proceeds to the 
open-loop analysis, controller design, linear closed-loop analysis, and finally nonlinear 
closed-loop simulation. If necessary, the controller design process is repeated until 
satisfactory performance is achieved. 

Control law synthesis and analysis require dynamic models of the flexible airplane, the 
actuation system, and wind disturbances, as well as measurement equations for structural 
displacements, velocities, accelerations, bending, torsion, and shear. These models are 
connected to perform open-loop analysis, control law synthesis, and, when combined with 
a control law, closed-loop performance evaluation. The airplane is represented at each 
flight condition by a set of constant coefficient, linear second-order differential equations 
with first-order lag terms. Figure 25 is a block diagram of a flexible airplane model. The 
individual blocks may represent nonlinear relationships. 

The unsteady aerodynamic forces are modeled by an approximate transformation from 
frequency to time domain with a least-square fit of a second-order polynomial in the 
Laplace variable s. The result is steady and unsteady aerodynamic forces as functions of 
displacements and the corresponding first- and second-order time derivatives. The 
unsteady effects associated with gust inputs are approximated with Kussner lift-growth 
functions. Only linear actuator models are considered at this point in the analysis. 
Because of its simplicity, the Dryden turbulence model for vertical gusts was selected as 
representative of gust disturbances. 
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States of the system: Legend: 


rigid- and flexible-mode deflections 
corresponding rates 

unsteady aerodynamic states associated with q 
steady aerodynamic states associated with 5 
unsteady gust states 


F$cs steady aero control surface forces 

^SM steady aero forces 

F sw steady aero wind gust forces 

Fycs unsteady aero control surface forces 

Fysivi unsteady aero forces 

Fyw unsteady aero wind gust forces 

q rigid- and flexible-mode deflections 

w q vertical gust velocities 

y y measurement deflections 

6 aerodynamic control surface deflections 

( ' ) differentiation with respect to time 

{") double differentiation with respect to time 


Figure 25. Model of the Flexible Airplane 
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Final Integrated ACT Control Law 


Constant gain control laws for suppression of the symmetric flutter mode and GLA were 
synthesized at eight separate flight conditions for the Initial ACT Airplane. These flight 
conditions corresponded to four speeds and two mass distributions. Four conditions were 
critical for GLA design and four were critical for FMC design. Six airplane control 
surfaces were considered: inboard and outboard elevators, inboard and outboard segments 
of the outboard aileron, complete outboard aileron, and inboard aileron. These surfaces 
were analyzed to determine their relative effectiveness in controlling the flutter mode 
and in producing load responses. The outboard aileron was best suited for flutter-mode 
control and the outboard aileron and elevator best suited for controlling wing loads. For 
this study, elevator and outboard ailerons were used as control surfaces. 

Specific sensor selection criteria are described in Reference 6. The two most important 
criteria were mode observability and performance parameter observability. Twenty-seven 
accelerometer locations were evaluated. Three sensors were selected: one pitch-rate 

gyro at the airplane center of gravity to observe the short-period mode and two normal 
accelerometers (one in each wing) to observe the structural modes of the wing. 

The best single location for an accelerometer was behind the outboard aileron hingeline 
near the wing tip. It provided high flutter-mode observability and high root-mean-square 
output and showed good correlation with inboard and outboard wing-bending moment 
indicators that had been embedded in the models of the airplane. The inboard wing- 
bending moment had been selected as the main gust-load parameter to be reduced through 
GLA control system design. 

Control law design for GLA began with a full-state feedback system based on a cost 
function that included inboard bending moment, inboard torsion, outboard bending 
moment, outboard torsion, and aileron and elevator commands. Analysis of these control 
laws showed that the airplane short period was dominant in all loads and that the inboard 
torsion was most influenced by the flutter mode and the first engine strut mode. Elevator 
activity was dominated by the short-period mode, while aileron activity was dominated by 
the first structural mode. A Kalman state estimator was introduced that yielded a system 
with stability margin deficiencies at two of the flight conditions. This was corrected by 
making the Kalman filter more robust at the expense of slightly degraded performance. 
At this point, the 53rd-order Kalman filter was reduced to an 8th-order filter. The 
reduced-order filters for the four flight conditions were integrated, yielding one design 
that worked satisfactorily at all four gust-load flight conditions. 

Development of the FMC control law designs paralleled the gust-load designs just 
discussed. The flutter mode of interest is caused primarily by coupling among wing 
vertical bending, wing torsion, and nacelle strut vertical bending, with a natural frequency 
of approximately 20 rad/s. The FMC goals were to achieve satisfactory structural 
damping at each of the flight conditions with moderate (50- and 75-deg/s root mean 
square) aileron rates for a gust intensity of 4.27-m/s (14-ft/s) root mean square. The final 
FMC control law required a lOth-order filter. 

An integrated (GLA and FMC) 8th-order filter was produced by curve-fitting with 
selected poles and zeros from the gust-load and flutter-mode control designs. The final 
integrated design is shown in block diagram form in Figure 26. The control law uses 
parameter gain schedule as a function of speed. 
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z at sensor No. 1 1 , m/s^ (ft/s^) 



Legend: 

5^ aileron deflection, deg 

6 e elevator deflection, deg 

z wing normal acceleration at 
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pi 
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c 2 
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a 2 
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c 3 

-0.284 

-1.515 

a 3 

2.053 

-3.22 

d 1 

10.14 

11.96 

a 4 

8.18 

432.6 

d 2 

51.12 

324.4 

b 1 

19.6 

14.59 

d 3 

0.5335 

-1.139 

b 2 

121.0 

45.67 

d 4 

0.07673 

1.765 

b 3 

“0.1 56 

-126.0 

d 5 

5.38 

0.2025 

b 4 

-1.24 

-0.909 

d 6 

-0.0468 

0.2025 
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3,4 
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1,2 
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38.8 

3.78 

mm 

36.5 

36.5 

0 


7.37 

8.03 

0 

1 

-10.9 

-11.9 

0 


-1.42 x IQ ' 7 
(-4.65 x 10 -7 ) 

-1 .42 x 10 -7 
(-4.65 x 10~ 7 ) 

0 

H 

-3.01 x 10 ' 6 
(- 9.88 x 10‘ 6 

-3.01 x 10 " 6 
(-9.88 x 10" 6 ) 


D 

5.01 x 10 -7 
(1.64 x 10“ 6 ) 

5.46 x 10 ~ 7 
(1.79 x 10 -6 ) 

2.77 x 10 " 7 
(9.08x10 -7 ) 

k 8 

9.24 x 10 -6 
(3.03 x 10- 5 ) 

1.01 x 10 -5 
(3.30 x 10' 5 ) 

i 

6.64 x 10 ' 6 
(2.18 x 10 ~ 5 ) 


0 2 

Note: Dimensions are in units of m/s*(ft/s ) and deg/s 


Figure 26. Block Diagram of Final Integrated Active Control Law Design 
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Optimal and Classical Controller Comparison 


Classical Controller Block Diagram— In support of the Initial ACT Airplane design activity, 
control laws were also synthesized for the eight flight conditions using classical 
techniques. A block diagram of the classical control law design is shown in Figure 27. 
Although these control laws are not the same ones assumed for the system simulation and 
reflected in Figures 14, 17, and 18, comparison of the performance of these classically 
developed control laws and the previously discussed optimal control and estimation- 
theory-based control laws can serve to highlight the results of these two approaches. The 
results were compared based on root-mean-square response to a von Karman gust and with 
a simulation using a discrete gust. 

Several important distinctions should be noted with respect to the two designs. The 
optimal controller is an integrated multiloop filter that provides the GLA, FMC, and PAS 
functions. The classical approach relies on single-loop design techniques that result in 
separately designed filters for each function. In addition to GLA, FMC, and PAS, the 
classical design also addresses MLC. 

These two designs use the outboard aileron in a slightly different manner. The optimal 
design uses the outboard aileron as a single surface, together with the elevator, for all 
control tasks. The classical design uses the inboard segment of the outboard aileron as a 
flutter-mode control surface, the total outboard aileron is used for load reduction, and the 
elevator is used for pitch augmentation. 

Both designs use two types of sensors: a pitch-rate gyro at the airplane center of gravity 
and the wing-mounted accelerometer. The classical design uses a wing-mounted 
accelerometer somewhat inboard of that of the optimal design. 
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Legend: 
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5 col 

5 e 
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FMC gain 
GLA gain 

control column deflection, deg 
elevator deflection, deg 

outboard aileron deflection, inboard segment, deg 
outboard aileron deflection, outboard segment, deg 
pitch rate, deg/s 

2 2 

body normal acceleration at eg, m/s (ft/s ) 

2 2 

wing normal acceleration at sensor No. 1 1 , m/s (ft/s ) 



Figure 27. Block Diagram of Classical Control Law Design 
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Random Gust Response— Table 4 shows the response of both designs to a random gust for 
flight condition 2. The classical control law performance is shown in response to a von 
Karman wind model, and the optimal control law performance is shown in response to both 
a Dryden and a von Karman model. The optimal controller was designed specifically for 
the Dryden model; hence, its performance is slightly better with the Dryden model than 
with the von Karman spectrum. 

Table 4(a) shows the optimal design to be very comparable, in terms of bending moment, 
to the classical design. The optimal design is significantly better in reducing torsion at 
the inboard station than the classical design. 

The most significant differences between the optimal and the classical design are shown 
in Table 4(b). The aileron deflection and rate requirements of the optimal system are 
significantly smaller than those required by the classical system. This is in part due to 
the approximately 25% greater root-mean-square (rms) elevator deflection and 
approximately 50% greater rms elevator rate of the optimal design. However, for both 
designs, the elevator activity is modest compared to the aileron activity. 
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Table 4 . Random Gust Response Comparison, Flight Condition 2 


(a) Incremental Load Reduction (Percent of Open Loop) 


Design 

Gust 

Inboard bending 
moment, 17 = 0.25 

Outboard bending 
moment, 17 = 0.75 

Inboard torsion, 
V = 0.25 

Optimal 

Von 

Karman 

71.2 

65.6 

91.2 

Dryden 

68.5 

61.9 

87.4 

Classical 

Von 

Karman 

70.4 

61 .9 

101.0 


77 = fraction of semispan (2 y/b) 


(b) Control Surface Activity 


Design 

Gust 

Elevator 

deflection, 

deg 

Elevator rate, 
deg/s 

Outboard aileron 
deflection, deg 

Outboard aileron 
rate, deg/s 

Optimal 

Von 

Karman 

1.25 

9.90 

1.88 

24.1 

Dryden 

1.27 

8.88 

1.79 

20.0 

Classical 

Von 

Karman 

1.00 

6.16 

5.29 a 

4.53^ 

71.0 a 
33. 6 b 


a lnboard segment of outboard aileron 
^Outboard segment of outboard aileron 
• Gust intensity = 8.5 m/s (28 ft/s) 
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Discrete Gust Response— To complete the comparison of these two system designs, their 
response to a 1-cos discrete gust was simulated. Table 5(a) shows the incremental load 
(measured as a percent of the open-loop peak load). The classical design reduces inboard 
bending moment slightly more effectively; the optimal design is slightly more effective in 
reducing outboard bending moment. With respect to bending moment, the two designs 
should be considered comparable. The classical design has a slightly higher torsion 
penalty as noted in the last column in Table 5(a). 

The significantly lower aileron deflection and aileron rate requirements of the optimal 
design are shown in Table 5(b). These rates would have a significant impact on the 
hydraulic distribution system. The lower aileron deflection and rate requirements of the 
optimal design are in part due to the greater use of the elevator, as also shown in the 
table. 
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Table 5. Discrete (1-cos) Gust Response Comparison, Flight Condition 2 


(a) Incremental Load Reduction at Peak (Percent of Open Loop) 


Design 

Inboard bending 
moment, 77 = 0.25 

Outboard bending 
moment, 77 = 0.75 

Inboard torsion, 
7? = 0.25 

Optimal 

90.2 

67.0 

107.0 

Classical 

85.4 

70.3 

116.0 


(b) Control Surface Activity 


Design 

Elevator deflection, 

Elevator rate. 

Outboard aileron 

Outboard aileron 

deg 

deg/s 

deflection, deg 

rate, deg/s 

Optimal 

8.29 


10.6 

106.0 

Classical 

5.30 

35.1 


175.0 a 





142.0 b 


a lnboard segment of outboard aileron 
“Outboard segment of outboard aileron 

• Gust intensity = 28.5 m/s (93.4 ft/s) 
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Optimal and Classical Pitch Augmentation Comparison 

PAS Controller Structure Comparison— Data in this section are presented to illustrate that 
both classical synthesis and optimal synthesis techniques can be used to create PAS 
controllers with acceptable system performance. 

The optimal control design procedure consists of two parts: full-state feedback design 

and state estimator design. Only the control problem; i.e., the full-state feedback design, 
has been addressed here. Figure 28(a) shows the optimal controller structure. Explicit 
model-following was used to produce column command responses virtually identical to 
those of an ideal model. An advantage of the optimal control method is that it allows 
separation of the control and estimation problems. Normally, the full-state feedback 
design cannot be implemented without constructing a state estimator. Experience with 
the GLA and FMC control law designs, as discussed in Section 12.0 of Reference 6, 
indicates that acceptable performance would be obtained when the control law is modified 
to include a state estimator. 

The classical methods of controller synthesis were used to design the PAS implementation 
shown in Figure 28(b). A quasi-steady aeroelastic model of the airplane with the three 
basic degrees of freedom (u, w, and q) was used in the design work. 

A principal objective in the PAS design effort was the desire to keep the configuration 
simple, using a minimum of feedback signals and gain changes, and yet have it produce 
augmented airplane stability and handling characteristics that were entirely acceptable 
over a broad range of operational flight conditions. 





Disturbances 



(a) Optimal Control 



Disturbances 




scalar signal 
vector signal 

perturbation speed, angle of attack, pitch rate, attitude 
airplane states (u, a, q, 0) 

synthesized ideal model state variables (u m , a m , q m , 0 m ) 

elevator actuator states 

gains 

elevator column 
elevator angle 
elevator command 


Figure 28. Optima! and Cfassicaf Pitch-Augmented Stability implementation 
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Control Column Response— Responses of the optimal synthesis system, and the classical 
synthesis system, to step column inputs are compared in Figures 29, 30, and 31 for two 
flight conditions. These data show that both methods produce acceptable responses to 
column commands. 

Flight condition 58 is a high-altitude, aft center-of-gravity condition. The Mach number 
is 0.65, altitude is 11 125m (36 500 ft), gross weight is 122 500 kg (270 00 0 lb), and the 
center of gravity is 0.46 mean aerodynamic chord. The classical system response can be 
characterized as a rapid rise with no overshoot, as shown in Figure 29. By comparison, 
the optimal system has a faster rise time with about a 50% overshoot, which produced a 
more rapid normal acceleration response. These two response characteristics are both 
estimated to yield satisfactory handling qualities. However, by changing the ideal model 
response, the optimal design could be made to match the classical system response. 

Flight condition 97 is a sea-level, flaps-down approach condition (1.3 times stall speed). 
The gross weight is 90 720 kg (200 000 lb) with the center of gravity of 0.46 mean 
aerodynamic chord. For this flight condition, the optimal system also has slightly faster 
response with small overshoot in pitch rate. 

The elevator responses (fig. 31) of the optimal system and the classical system are similar 
for both flight conditions. This is to be expected because the character of the elevator 
response is determined largely by the stability of the vehicle and the desired response. 
Larger control deflections are required for the optimal system, because that system was 
designed for the Initial ACT Configuration, which is somewhat less stable than the aspect 
ratio 12 configuration (Wing Planform Study, refs 4 and 5), for which the classical system 
was designed. 

An advantage of the optimal control law synthesis method is that it directly produced the 
feedback gains necessary to cause the augmented airplane to behave similarly to a desired 
response. The method allowed acceptable designs in response to command inputs as well 
as in response to turbulence. 
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Incremental loadfaetor Incremental pitch rate, q, deg/s 



(a) Pitch-Rate Response to Step Column Command 



Time, sec 

(b) Acceleration Response to Step Column Command 

Figure 30. Optimal and Classical System Response to Column Input 
(Flight Condition 97) 
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IMPLEMENTATION ALTERNATIVES 


Anticipated Technology Developments and ACT System Alternatives 

The objective of this part of the Advanced Technology ACT Control System Definition 
Task was to identify an ACT system implementation based on component properties and 
characteristics expected to be available for a commercial airplane circa 1990. The first 
phase of this work examined the technology developments in sensors, actuators, computer 
hardware, and computer software and projected that status to approximately 1990. The 
second phase defined three alternative systems with varying degrees of risk and 
qualitatively assessed them. The final phase selected a 1990 implementation of ACT and 
performed reliability and cost-of-ownership analyses for that system. 

The sensor survey addressed air data, attitude, angular rate, and acceleration sensors. It 
was concluded that air data should be obtained from the airplane's triplex digital air data 
system and the attitude signals from the triplex inertial reference system. Based on 
examination of several present and evolving concepts for angular rate sensors, the ring 
laser gyro was recommended. Center-of-gravity acceleration is best obtained from the 
inertial reference system output signals. Wing-mounted accelerometers should be piezo- 
resistive strain gages because of their relatively low cost and high dynamic response. 

Ultrareliable high-speed central processing components are expected in the late 1980s, 
resulting from very-large-scale and very-high-speed integrated circuit developments, with 
associated reductions in chip counts and connections between chips. Size, weight, and 
power requirements of the system's computers will no longer be a significant consider- 
ation and costs will be reduced to relatively unimportant levels. Standardization of 
instruction sets should permit efficient and reliable flight controls software development. 

Actuation concepts were reviewed and compared to the requirements. It was concluded 
that, except for the flaperons, conventional hydraulic actuation concepts should be 
applied for a 1990 ACT airplane. 

Three alternative advanced technology ACT system configurations, characterized as 
having low, medium, and high risk for a circa 1990 implementation, are shown in 
Figure 32. The high-risk system (fig. 32(a)) capitalizes on recent and projected advances 
in self-testing digital circuitry and in integrated circuit technology. The computational 
element, consisting of four self-checking computer modules of multiple microprocessors, 
builds on the concepts used in the fault-tolerant multiple processor (FTMP) and software- 
implemented fault tolerance (SIFT) architectures. Each module is 100% self-checking and 
does not require cross-channel comparison. The computers run asynchronously, and the 
system relies on ultrareliable self-checking bus adapters and controllers. 

The medium-risk system (fig. 32(b)) uses multiple microprocessors, operating asynchro- 
nously, in each computing channel. Serial digital data busing is used extensively for both 
sensor and actuator interfaces. The principal objectives of this design were to create an 
increased number of success paths for flight safety and dispatch reliability and to reduce 
software complexity and preparation costs. 

The low-risk system (fig. 32(c)) follows the developments of the 1970s, with frame- 
synchronized computers. Data are exchanged between the redundant computers by 
dedicated serial buses. Computations are identical among computers. Sensor and servo 
interfaces are primarily analog, and only moderate technology growth is assumed. 
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Alternative System Comparison 


Key characteristics of the three alternative systems are shown in Table 6. The low-risk 
system could best be characterized as current technology, requiring relatively complex 
software and using serial digital data buses for only the inertial reference system and 
digital air data computer outputs, with all other sensors hardwired (analog) to the ACT 
computers. The computers are frame synchronized with self-check and bit-by-bit 
comparison monitors. Finally, the system assumes the presence of an analog backup 
system. 

The medium-risk system uses extensive busing and multiple microprocessors and assumes 
that projections of software and integrated circuit technologies have a reasonable 
probability of being available for system realization by 1990. The sensor set is the same 
as the low-risk system set, except that no separate pitch-rate sensor is provided. A 
Luenberger observer is used to estimate pitch rate if two of the three identical inertial 
reference system rate gyros fail. The computer architecture differs significantly from 
the low-risk system in the area of multiple microprocessors operating asynchronously. 
This is expected to lead to more simplified software. 

The high-risk system uses the same sensor set as the medium-risk system set, with data 
input on a common serial digital bus. It has a single universal quadruple bus system 
instead of the separate bus systems present in the medium-risk and low-risk systems. 
Finally, the quadruple computer system is composed of self-checking computing modules. 
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Table 6. Alternative System Comparison 




System features 


Characteristics 

Low risk 

Medium risk 

High risk 

• Sensor set 

• Three 1 RSs 

• Same as the low-risk sys- 

• Same as the medium- 


• Three DADCs 

• Three sets of acceler- 
ometers for WLA and 
FMC 

• Four pilot input 
transducers 

• One pitch-rate sensor 

tern without pitch-rate 
sensor 

risk system 

• Sensor input approach 




• IRS \ 

• Serial digital bus to the 

• Serial digital bus to I/O 

• On common serial 

• DADC J 
• Others 

ACT computer 
• Hardwired analog to the 
ACT computer 

processor 

digital bus 

• Failure management 




• Critical functions 

• Majority vote and com- 

• Same as the low-risk 

• Same as the low-risk 


parison monitoring 

system 

system 

• Crucial functions 

• Same with fourth pitch- 

• Same with Luenberger 

• Same as the medium- 


rate sensor 

observer to estimate q 
from vertical accelera- 
tion and other signals 

risk system 

• Bus structure 

• Two bus systems 

• Three bus systems 

• One universal quad- 


• ARINC 429 from IRS 

• Quadruple sensors to 

ruple bus system 


and DADC to ACT 
computer 
• Serial digital data 
exchange between 
computers 

I/O processor 

• Quadruple I/O proces- 
sor to output monitor 
processor 

• Triplex, output 
monitor processor 
to servos 

• Self-checking 

• Computer system 




• Redundancy 

• Quadruple 

• Quadruple 

• Quadruple 

• Architecture 

• Uniprocessors 

• Multimicroprocessors 

• Sensor 

• I/O 

• Control law 

• Output monitor 

• Servo 

• Self-checking comput- 
ing modules composed 
of multiple processors 

• Synchronization 

• Frame synchronized 

• Asynchronous 

• Asynchronous 

• Failure management 

• Self-check and bit-by-bit 

• Output monitor pro- 

• Completely self-check- 


comparison monitor 

cessor, comparison 

ing, no comparison 

• Analog backup 

• Yes 

• No 

• No 

• Servos and actuators 




• Servo loop 

• In ACT computers 

• In dedicated servo- 

• Incorporated in 

electronics 


microprocessor 

multiprocessor 

• Command output 

• Hardwired analog 

• Serial digital buses 

• On common serial 

approach 


• Quadruple to OMP 

• Triplex OMP to servo 

digital bus 

• Failure 

• Monitored in ACT 

• Monitored in OMP 

• Monitored in ACT 

management 

computer 

• Fault correction via 

computer 


• Hardwired fault 
correction 

serial bus 

• Fault correction via 
bus 

• Software 

• Complex, 1980 

• Simplified, segmented 

• Simpler because of self- 

characteristics 

technology 

into microprocessors by 
function; reduced redun- 
dancy management 
required 

checking autonomous 
channels, highly reliable 
through advanced verifi- 
cation and validation 

• Reliability assessment 

• 4 x icr 12 

• < icr 12 

• Not assessed 

(probability of failure 
during 1 -hr flight)* 





* Reliability assessment is for sensing and computation (actuation excluded) and assumes 
software reliability and coverage equal to 1.0. 
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1990 ACT System Architecture 


A derivative of the medium-risk system described previously was selected for further 
evaluation and cost-of-ownership analysis. This system is called the 1990 ACT System. 
The 1990 ACT System uses redundant buses for sensor-computer and computer-actuator 
interfaces, with all sensor data available to all computing channels. The computing is 
asynchronous among channels and is compartmented such that separate microcomputers 
perform input/output (I/O) processing, control law computations, and redundancy 
management. This avoids the monolithic software structure and results in lower cost for 
software design, validation, and verification. The sensors and actuators have self- 
contained electric power supplies and bus interface circuits. The crucial control law 
computation mode is assumed by the I/O microcomputer if the control law microcomputer 
fails in that channel. This provides additional redundancy and reliability for the crucial 
functions. 

The 1990 ACT System is integrated; all functions are performed by each of the central set 
of four ACT computers. Sensors and control surface actuators are shared between 
functions to the extent allowed by the control laws. The airplane's primary control is fly 
by wire with all control surface actuators signaled electrically. Figure 33 shows the 
system architecture. 

The ACT Maintenance and Display Computer, warning electronics module, and dedicated 
ACT panel interface with the computers by the same set of four buses associated with the 
surface actuators. Each sensor contains bus interface electronics, including an analog-to- 
digital (A/D) converter, an asynchronous serial I/O communication circuit, and the logic 
necessary to handle data requests and transmissions. 

Each hydraulic servoactuator contains electronics to receive and decode serial data, 
convert the commands to an analog signal, demodulate the feedback signals required for 
servo control, and close the servo loop. 

The probability of total function loss of the crucial PAS function was estimated to be 
1.7 x 10"12 during a flight of 1 hr, assuming software reliability and coverage equal to 1.0. 
The probability of loss of any critical ACT function was estimated to be 2.7 x 10“^. Both 
estimates are more than one order of magnitude less likely than the goals of probability of 
loss of crucial function to be less than 10“9 and probability of loss of critical functions to 
be less than 10"-5. 
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Figure 33. 1990 ACT System Architecture 
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Cost-of-Ownership Evaluation 

Cost of ownership for the 1990 ACT System was analyzed and compared with the current 
technology systems. Because cost of ownership depends upon airplane configuration and 
the most complete data set was available for the Initial ACT Configuration (refs 2 and 3), 
the external aerodynamic characteristics, active control functions, and surfaces of that 
airplane were assumed. Thus flaperons were not included in the cost-of-ownership 
evaluation. The analysis for the 1990 ACT System was performed based on increments 
from the current technology Selected System discussed previously. 

Basically, the 1990 ACT System differs from the Selected System as follows: 

• All mechanical connections and components connecting the cockpit flight controls to 
the actuator servovalves are deleted. 

• Mechanical servo feedback to hydraulic power control unit servovalves is deleted. 

• All ACT secondary servos and the two FMC servos are deleted. 

• Four flight control computers replace the three ACT Primary Computers and four 
Essential PAS Computers of the Selected System. 

• Sensors peculiar to the Selected System are replaced by the sensors that can 
communicate directly to the digital data bus. 

• All autopilot and yaw damper actuators are replaced by primary fly-by-wire actuators. 

The cost-of-ownership parameters shown in Table 7 are based on estimates of line 
replaceable unit cost, weight, and maintenance costs for the 1990s. The most important 
differences between the Selected System and the 1990 ACT System are the significant 
reductions in incremental airplane purchase cost and airplane weight. Approximately one- 
quarter of the weight reduction and about one-half of the incremental airplane price 
reduction would be available to the Selected System through implementation of fly by 
wire. The balance of the savings stem from the advanced technology incorporated into 
the 1990 ACT System. 

Most of the cost reduction is due to deleting thousands of parts inherent in the mechanical 
transmission of pilot's control signals and deleting autopilot actuators. The weight 
reduction is primarily derived from deletion of mechanical flight controls, with significant 
contributions from the autopilot actuator deletion and the substitution of a lower weight 
fly-by-wire surface control actuator. The weight savings lead to significant increases in 
the fuel saving per flight hour (table 7). 

The most significant result of this work, as shown in Table 7, is the improvement of the 
1990 ACT System relative to the current technology Selected System. Of special interest 
is the approximately 42% increase in return on incremental investment (1990 ACT System 
relative to the Selected System) and the approximately 30% reduction in the payback 
period to the airline. 
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Table 7. Cost-of-Ownership Results for Various ACT Systems 


Parameter 

Current technology 

Advanced 

technology 

incremented 

Integrated 

Segregated 

Selected 

Selected + 
pitch FBW 

1990 ACT 

Aircraft purchase cost per aircraft 
(in 1000 dollars) 

274 

390.2 

297.1 

207 

98.8 

Maintenance manual cost per 
30-aircraft fleet (in 1000 dollars) 

21 

31.4 

26.1 

26.1 

54.7 

Test equipment cost per 
30-aircraft fleet (in 1000 dollars) 

22.5 

44.9 

33.6 

33.6 

10.0 

Spare inventory initial cost per 
30-aircraft fleet (in 1000 dollars) 

250 

356 

271.1 

271.1 

221.1 

Maintenance cost per aircraft 
flight hour (in dollars) 

4.18 

4.91 

4.22 

3.98 

-0.59 

Departure delay and cancellation 
cost per aircraft flight hour (in dollars) 

0.54 

0.45 

0.19 

0.12 

0.54 

Change in system weight 
relative to Integrated ACT 

0 

-hi 1 4 kg 
(+252 lb) 

+14 kg 
(+30 lb) 

-156 kg 
(-345 lb) 

-629 kg 
(-1386 lb) 

Fuel saving per flight hour at 863 km 
(466 nmi) 

160 kg 
(352 lb) 

146 kg 
(322 lb) 

160 kg 
(352 lb) 

172 kg 
(379 lb) 

212 kg 
(468 lb) 

Payback period in years 

2.83 

4.14 

2.98 

2.02 

<2.0 

Return on incremental investment to airline 

25.1% 

22.1% 

24.6% 

27.6% 

34.9% 
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CONCLUDING REMARKS 


The results to date of the IAAC Project show that the concept of an ACT airplane 
designed as such from the outset will indeed yield important savings in block fuel over a 
similar commercial transport without active controls. The results of the Current and 
Advanced Technology ACT Control System Definition work summarized in this report 
show that it is feasible to support such an active controls airplane with a control system 
that meets all reliability and availability requirements (assuming software reliability and 
coverage equal to 1.0). The results also show that this can be done at a cost that provides 
an attractive return on investment for the airline. The ACT systems will become even 
more attractive if fuel prices continue to inflate as experienced since early in the 1970s. 

The Current Technology ACT Control System Definition Task had two primary objectives. 
The first objective was to define a digital ACT control system architecture using flight 
control system elements currently in use or considered acceptable for commercial 
transports. The second objective was to identify the major concerns and then resolve 
issues related to the use of such a control system. Three control systems (Integrated, 
Segregated, and Selected) were designed, and all met the reliability requirements. The 
Segregated System is predicted to be the most reliable, followed in order by the Selected 
System and then the Integrated System. The Integrated System with its single set of 
redundant digital control computers is the most efficient of the three systems; i.e., it 
satisfies function and reliability requirements at the lowest cost. The Segregated System 
failed to show the expected major improvements in reliability and exhibited unacceptably 
higher costs. The Selected System shows a decided reliability improvement over the 
Integrated System with only a small increase in cost. 

The major concerns that arise from review of these results are system complexity and the 
ever-present question of system reliability in the operational environment. Hardware 
reliability predictions are based on consistently conservative choices in values for system 
elements and in the techniques and system representations used in the reliability 
calculations. Although the absolute values of the resulting reliability predictions may be 
suspect, their use as one of several figures of merit is considered well founded. 

There is no generally accepted method to prove software reliability equal to the required 
level. However, extensive experience in engineering real-time digital control systems for 
airplanes and spacecraft has shown that a process that begins with careful functional 
analysis and leads through requirements, design, coding, verification, validation, 
exhaustive testing, configuration control, and careful documentation can produce highly 
reliable real-time control software. Therefore, it is concluded that the Selected System 
can be implemented using currently available technology and software design processes, 
although the ultimate production and certification of these systems will require 
significant additional experimental and confidence-building work. 

The objectives of the Advanced Technology ACT Control System Definition Task were to 
(1) determine the benefits of synthesizing ACT control laws using optimal control law 
estimation theory, (2) determine the effects of actuation system nonlinearities on gust- 
load alleviation and flutter-suppression effectiveness, and (3) identify advanced flight 
control system implementation concepts as an alternative to the current technology 
implementation previously discussed. 

Analysis procedures were developed that offer systematic methods for selecting proper 
control surfaces, actuation bandwidths, and sensor locations for specific ACT function 
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performance. The design procedures based upon time-domain optimal control theory offer 
a direct and systematic method to derive multiloop control laws that satisfy typical ACT 
design requirements. 

The medium-risk 1990 technology ACT system design met the objectives of providing the 
same ACT functions with suitable reliability at improved cost. The system is a quadruply 
redundant integrated system combined with fly-by-wire primary controls in all three axes. 
Its architecture is strongly oriented toward digital buses and multiple microprocessors, 
using quadruple input buses coupling digital sensors to the four central control computers 
and quadruple output buses feeding the servoelectronic units that incorporate digital-to- 
analog conversion. The system exhibits very attractive predicted return on incremental 
investment and appears feasible in the 1990 time period. The incorporation of fly by wire 
was a very large part of the cost benefit predicted for these advanced systems. 

The encouraging results of this control system work emphasize the desirability of 
proceeding with the planned laboratory tests and flight demonstrations of the 1AAC 
Project Plan (ref 1). The laboratory tests and flight demonstration are necessary to 
reduce the technical risks of committing a commercial transport program that will depend 
upon ACT to a level commensurate with current commercial practice. The current plan is 
to proceed with the IAAC Project according to the IAAC Project Plan (ref 1). 
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